Privacy Policy

FitScouts is a size adviser chat that online fashion shops install on their website. This page explains how FitScouts handles the data from those conversations and, if the shop installs the Shopify app, the data from its orders and returns.

If you are a customer of a shop that uses FitScouts, the privacy policy that applies to you is that shop’s, not this one. The shop decides what data is collected and why; FitScouts only processes it on the shop’s instructions. This page is here so you can see what happens underneath, and so the shop has the information it needs from its provider.

The shop is the data controller. It decides to install the adviser, what it uses the conversations for, and how long it keeps them within what the service allows.

FitScouts is the data processor. It processes data on the shop’s behalf, only to provide the service, and does not use it for its own purposes: it is not sold, not passed to third parties for commercial purposes, and not used to train artificial intelligence models.

The relationship between the two is governed by the data processing agreement required by Article 28 of the GDPR, signed when the service is contracted.

When someone writes in the chat, the following is processed:

• The content of the messages. It is free text, so it may include body measurements (bust, waist, hip), the size the person usually wears, and anything else they choose to write.
• A session identifier, to link the messages of the same conversation.
• An attribution marker on the cart. On Shopify, an attribute is added to the cart so the shop can tell which sales come from a conversation with the adviser.

Payment details (card, bank account) are never requested or processed. Nobody has to create an account or identify themselves to use the chat.

Body measurements are not, on their own, a special category of data under Article 9 of the GDPR, but they are sensitive in practice and are treated as such: they are not needed to use the adviser, and anyone who prefers not to give them can ask for a recommendation based on style and usual size.

If the shop installs the FitScouts app from Shopify, Shopify sends us its paid orders, refunds and returns. They are used so the shop can see which sales come from the adviser and why garments are sent back.

• For each order we store only the product, the size, the quantity, the amount and, if the customer talked to the adviser, the identifier of that conversation.
• For each return, the product and its reason (for example, “too small”).

We do not store customers’ names, emails, phone numbers or addresses. There is one case where an email is read: when a shopper asks the chat about her order without being logged in to the shop, she enters the order number and her email in a form, and we compare it at that moment with the order’s email so we only show her own order. That email is not stored, not logged and not sent to the AI model. If she is logged in, no email is read.

The app requests read access (read_orders, read_all_orders, read_returns and read_products) and write_app_proxy, which only lets the chat look up order status from the shop’s own website: it cannot create, change or delete anything in the shop. Order history from before installation, up to 12 months, is only imported if the shop asks for it from the dashboard.

This data is processed and stored on Cloudflare infrastructure (Workers, D1 and KV), which acts as a sub-processor.

When the app is uninstalled, access to the shop is removed, and 48 hours later, when Shopify sends the shop/redact notice, the orders and returns received are deleted. If a customer asks for her data to be erased, we delete her orders.

The adviser is an automated system, not a person. This is stated visibly in the chat interface itself.

The work is split like this: the size is calculated by code, comparing what is written against the measurement chart the shop has loaded. The AI model writes the conversation and understands the question. The size recommendation does not come from a generative model.

The adviser does not take decisions with legal effects or that significantly affect anyone: it recommends a size and some garments, and the decision to buy always rests with the person on the other side.

To generate replies, the conversation text is sent to the FitScouts server and from there to providers of artificial intelligence models, which act as sub-processors.

That processing may take place outside the European Union, including in countries whose level of data protection has not been declared adequate by the European Commission. If body measurements have been written in the conversation, those measurements leave the EU inside the text.

These transfers rely on the Standard Contractual Clauses approved by the European Commission, Module 2 (controller → processor), as an appropriate safeguard under Article 46 of the GDPR. They are incorporated into the AI provider’s data processing agreement.

The chain is: the shop is the controller, FitScouts the processor, and the AI model provider acts as sub-processor. The transfer that leaves the European Economic Area is the one from FitScouts to that provider.

Up-to-date list of sub-processors: trust.openrouter.ai

The data is used to provide the service the shop has contracted: understanding the question, calculating and recommending the size, answering about the shop’s catalogue and policies, and keeping the conversation available so the shop can review it and measure whether the adviser is working for it.

The legal basis is set by the shop as controller, and is usually its legitimate interest in serving and advising visitors to its website, or consent where the shop collects it. The specific information is in the shop’s privacy policy.

Applicable law: Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

Conversations are kept for 90 days after they end, so the shop can read them. After that they are deleted automatically, without anyone having to ask.

Orders and returns received through the Shopify app are deleted 48 hours after the app is uninstalled (see “Shopify app” above).

If the shop stops using the service, its conversations are deleted or returned to it as agreed in the data processing agreement.

The GDPR gives the rights of access, rectification, erasure, restriction, portability and objection.

If you are a customer of a shop, exercise them with the shop, which is the controller. When the shop passes a request on to us, FitScouts handles it and helps the shop reply within the deadline.

You can also complain to the Spanish Data Protection Agency (aepd.es) if you believe the processing does not comply.

The credentials for the AI models live on the server, never in the browser of the person using the chat. Communications are encrypted in transit. Access to stored conversations is limited to the shop that owns them and to whoever operates the service.

If a shop needs the detail of the technical and organisational measures under Article 32 of the GDPR for its records of processing, it can ask at the contact address below.

FitScouts is provided by an individual registered as self-employed in Spain, not by a company.

• Owner: Albert Moreno
• Tax ID (NIF): 47239092J
• Address: Avinguda Corts Catalanes 32, 08172 Sant Cugat del Vallès (Barcelona), Spain
• Data protection contact: info@fit-scouts.com

If the way the adviser works changes, this page is updated and the date at the top changes. Changes that affect shops are also communicated to them in writing.